CVE-2026-40973
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
EUVDEUVD-2026-25937
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
EUVD-2026-25937- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wwpq-f5c3-7hvx
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-wwpq-f5c3-7hvx- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
NVD
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
OSV
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
OSVGHSA-wwpq-f5c3-7hvx
Spring Boot accepts predictable temp directory without ownership verification
A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
- Record
GHSA-wwpq-f5c3-7hvx- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-377
- Updated
- 2026-11-02
Show 23 moreShow less
OSVRHLW-2026-196e0bd4df0804a6
Lightwell Security Advisory: spring-boot 2.7.18.rhlw-00004
Red Hat Lightwell has released org.springframework.boot:spring-boot 2.7.18.rhlw-00004 with backported fixes for CVE-2025-22235 and CVE-2026-40973.
CVE-2026-40973: A local attacker on the same host as the application may be able to take control of the directory used by ApplicationTemp. When server.servlet.session.persistent is set to true and the attack persists across application restarts, this may allow the attacker to read session information and hijack authenticated users or deploy a gadget chain and execute code as the application's user.
Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); predictable temp directory / ApplicationTemp ownership verification. Versions that are no longer supported are also affected per vendor advisory.
This patched artifact is a drop-in replacement for org.springframework.boot:spring-boot 2.7.18 from Maven Central.
- Record
RHLW-2026-196e0bd4df0804a6- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-40973
CVE-2026-40973 in org.springframework.boot:spring-boot - Patched by Root
Root has patched CVE-2026-40973 in the org.springframework.boot:spring-boot package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-40973- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1779065187 No score
TuxCare security update for org.springframework.boot:spring-boot (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot to address 1 CVE. Fixed in 2.7.18-tuxcare.14.
- Record
CLSA-2026-1779065187- Updated
- 2026-11-02
OSVCLSA-2026-1779410900 No score
TuxCare security update for org.springframework.boot:spring-boot (1 CVE)
TuxCare rebuilt org.springframework.boot:spring-boot to address 1 CVE. Fixed in 2.7.16-tuxcare.3.
- Record
CLSA-2026-1779410900- Updated
- 2026-11-02
OSVCLSA-2026-1779670114 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1779670114- Updated
- 2026-11-02
OSVCLSA-2026-1779842931 No score
TuxCare security update for org.springframework.boot:spring-boot (2 CVEs)
TuxCare rebuilt org.springframework.boot:spring-boot to address 2 CVEs. Fixed in 2.6.15-tuxcare.11.
- Record
CLSA-2026-1779842931- Updated
- 2026-11-02
OSVCLSA-2026-1780879907 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 2 CVEs. Fixed in 2.4.6-tuxcare.5.
- Record
CLSA-2026-1780879907- Updated
- 2026-11-02
OSVCLSA-2026-1781484852 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 2 org.springframework.boot packages to address 4 CVEs. Fixed in 2.4.5-tuxcare.2.
- Record
CLSA-2026-1781484852- Updated
- 2026-11-02
OSVCLSA-2026-1783558974 No score
TuxCare security update for org.springframework.boot (4 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1783558974- Updated
- 2026-11-02
OSVCLSA-2026-1783904634 No score
TuxCare security update for org.springframework.boot (6 CVEs)
TuxCare rebuilt 6 org.springframework.boot packages to address 6 CVEs. Fixed in 2.5.15-tuxcare.1.
- Record
CLSA-2026-1783904634- Updated
- 2026-11-02
OSVCLSA-2026-1783991067 No score
TuxCare security update for org.springframework.boot (9 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 9 CVEs. Fixed in 2.1.8.RELEASE-tuxcare.1.
- Record
CLSA-2026-1783991067- Updated
- 2026-11-02
OSVCLSA-2026-1784164094 No score
TuxCare security update for org.springframework.boot (7 CVEs)
TuxCare rebuilt 4 org.springframework.boot packages to address 7 CVEs. Fixed in 2.3.6.RELEASE-tuxcare.5.
- Record
CLSA-2026-1784164094- Updated
- 2026-11-02
OSVCLSA-2026-1787144370 No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787144370- Updated
- 2026-11-02
OSVCLSA-2026-1787144963 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787144963- Updated
- 2026-11-02
OSVCLSA-2026-1787145317 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.4.13-tuxcare.1.
- Record
CLSA-2026-1787145317- Updated
- 2026-11-02
OSVCLSA-2026-1788194802 No score
TuxCare security update for org.springframework.data:spring-data-commons (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-commons to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788194802- Updated
- 2026-11-02
OSVCLSA-2026-1788421913 No score
TuxCare security update for org.springframework.data:spring-data-ldap (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-ldap to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421913- Updated
- 2026-11-02
OSVCLSA-2026-1788421934 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 4 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788421934- Updated
- 2026-11-02
OSVCLSA-2026-1788422044 No score
TuxCare security update for org.springframework.data (4 CVEs)
TuxCare rebuilt 5 org.springframework.data packages to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422044- Updated
- 2026-11-02
OSVCLSA-2026-1788422148 No score
TuxCare security update for org.springframework.data:spring-data-keyvalue (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788422148- Updated
- 2026-11-02
OSVCLSA-2026-1788428259 No score
TuxCare security update for org.springframework.data:spring-data-redis (4 CVEs)
TuxCare rebuilt org.springframework.data:spring-data-redis to address 4 CVEs. Fixed in 3.3.13-tuxcare.4.
- Record
CLSA-2026-1788428259- Updated
- 2026-11-02
OSVCLSA-2026-1793299405 No score
TuxCare security update for org.springframework.boot (8 CVEs)
TuxCare rebuilt 7 org.springframework.boot packages to address 8 CVEs. Fixed in 2.7.9-tuxcare.1.
- Record
CLSA-2026-1793299405- Updated
- 2026-11-02
OSVCLSA-2026-1793801974 No score
TuxCare security update for org.springframework.boot (2 CVEs)
TuxCare rebuilt 3 org.springframework.boot packages to address 2 CVEs. Fixed in 2.7.8-tuxcare.2.
- Record
CLSA-2026-1793801974- Updated
- 2026-11-04
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootMaven |
4.0.0 up to 4.0.6 | 4.0.6 |
org.springframework.boot:spring-bootMaven |
3.5.0 up to 3.5.14 | 3.5.14 |
org.springframework.boot:spring-bootMaven |
3.4.0 to 3.4.15 | None known |
org.springframework.boot:spring-bootMaven |
3.3.0 to 3.3.18 | None known |
org.springframework.boot:spring-bootMaven |
through 2.7.32 | None known |
org.springframework.boot:spring-bootTuxCare:Maven |
2.7.18 up to 2.7.18-tuxcare.14, plus listed versions 2.7.18-tuxcare.102.7.18-tuxcare.112.7.18-tuxcare.122.7.18-tuxcare.132.7.18-tuxcare.8 Show 8 moreShow less2.7.18.tuxcare2.7.18.tuxcare.12.7.18.tuxcare.22.7.18.tuxcare.32.7.18.tuxcare.42.7.18.tuxcare.52.7.18.tuxcare.62.7.18.tuxcare.7 |
2.7.18-tuxcare.14 |
org.springframework.boot:spring-bootTuxCare:Maven |
2.7.16 up to 2.7.16-tuxcare.3, plus listed versions 2.7.16-tuxcare.12.7.16-tuxcare.2 |
2.7.16-tuxcare.3 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.3.13 up to 3.3.13-tuxcare.4, plus listed versions 3.3.13-tuxcare.13.3.13-tuxcare.23.3.13-tuxcare.3 |
3.3.13-tuxcare.4 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.6.15 up to 2.6.15-tuxcare.11, plus listed versions 2.6.15-tuxcare.102.6.15-tuxcare.22.6.15-tuxcare.32.6.15-tuxcare.42.6.15-tuxcare.5 Show 5 moreShow less2.6.15-tuxcare.62.6.15-tuxcare.72.6.15-tuxcare.82.6.15-tuxcare.92.6.15.tuxcare.1 |
2.6.15-tuxcare.11 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 |
2.4.6-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.4.6 up to 2.4.6-tuxcare.5, plus listed versions 2.4.6-tuxcare.32.4.6-tuxcare.42.4.6.tuxcare.2 |
2.4.6-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
2.4.5 up to 2.4.5-tuxcare.2, plus listed versions 2.4.5-tuxcare.1 |
2.4.5-tuxcare.2 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 4 CVEs |
3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 4 CVEs |
3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 4 CVEs |
3.4.13 up to 3.4.13-tuxcare.1 | 3.4.13-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 6 CVEs |
2.5.15 up to 2.5.15-tuxcare.1 | 2.5.15-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-loaderTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 9 CVEs |
2.1.8.RELEASE up to 2.1.8.RELEASE-tuxcare.1 | 2.1.8.RELEASE-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 7 CVEs |
2.3.6.RELEASE up to 2.3.6.RELEASE-tuxcare.5, plus listed versions 2.3.6.RELEASE-tuxcare.12.3.6.RELEASE-tuxcare.22.3.6.RELEASE-tuxcare.32.3.6.RELEASE-tuxcare.4 |
2.3.6.RELEASE-tuxcare.5 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-actuator-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-devtoolsTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-actuatorTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 8 CVEs |
2.7.9 up to 2.7.9-tuxcare.1 | 2.7.9-tuxcare.1 |
org.springframework.boot:spring-bootTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-autoconfigureTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-boot-starter-mailTuxCare:Maven From an advisory covering 2 CVEs |
2.7.8 up to 2.7.8-tuxcare.2, plus listed versions 2.7.8-tuxcare.1 |
2.7.8-tuxcare.2 |
org.springframework.boot:spring-bootMaven |
4.0.0 up to 4.0.6, plus listed versions 4.0.14.0.24.0.34.0.44.0.5 |
4.0.6 |
org.springframework.boot:spring-bootMaven |
3.5.0 up to 3.5.14, plus listed versions 3.5.13.5.103.5.113.5.123.5.13 Show 8 moreShow less3.5.23.5.33.5.43.5.53.5.63.5.73.5.83.5.9 |
3.5.14 |
org.springframework.boot:spring-bootMaven |
3.4.0 to 3.4.15, plus listed versions 3.4.13.4.103.4.113.4.123.4.13 Show 8 moreShow less3.4.23.4.33.4.43.4.53.4.63.4.73.4.83.4.9 |
None known |
org.springframework.boot:spring-bootMaven |
3.3.0 to 3.3.18, plus listed versions 3.3.13.3.103.3.113.3.123.3.13 Show 8 moreShow less3.3.23.3.33.3.43.3.53.3.63.3.73.3.83.3.9 |
None known |
org.springframework.boot:spring-bootMaven |
through 2.7.32, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
None known |
org.springframework.boot:spring-bootRed Hat Lightwell:Maven From an advisory covering 2 CVEs |
before 2.7.18.rhlw-00004, plus listed versions 1.0.0.RELEASE1.0.1.RELEASE1.0.2.RELEASE1.1.0.RELEASE1.1.1.RELEASE Show 45 moreShow less1.1.10.RELEASE1.1.11.RELEASE1.1.12.RELEASE1.1.2.RELEASE1.1.3.RELEASE1.1.4.RELEASE1.1.5.RELEASE1.1.6.RELEASE1.1.7.RELEASE1.1.8.RELEASE1.1.9.RELEASE1.2.0.RELEASE1.2.1.RELEASE1.2.2.RELEASE1.2.3.RELEASE1.2.4.RELEASE1.2.5.RELEASE1.2.6.RELEASE1.2.7.RELEASE1.2.8.RELEASE1.3.0.RELEASE1.3.1.RELEASE1.3.2.RELEASE1.3.3.RELEASE1.3.4.RELEASE1.3.5.RELEASE1.3.6.RELEASE1.3.7.RELEASE1.3.8.RELEASE1.4.0.RELEASE1.4.1.RELEASE1.4.2.RELEASE1.4.3.RELEASE1.4.4.RELEASE1.4.5.RELEASE1.4.6.RELEASE1.4.7.RELEASE1.5.0.RELEASE1.5.1.RELEASE1.5.10.RELEASE1.5.11.RELEASE1.5.12.RELEASE1.5.13.RELEASE1.5.14.RELEASE1.5.15.RELEASE |
2.7.18.rhlw-00004 |
org.springframework.boot:spring-bootRoot:Maven |
before 2.7.11-aikido.2 | 2.7.11-aikido.22.7.11-aikido.13.5.12-aikido.23.4.5-aikido.13.3.4-aikido.33.4.2-aikido.33.4.4-aikido.73.5.13-aikido.24.0.5-aikido.24.0.5-aikido.33.5.12-aikido.14.0.6-aikido.1 |
io.root.org.springframework.boot:spring-bootRoot:Maven |
before 2.7.11-root.io.2 | 2.7.11-root.io.24.0.5-root.io.13.4.4-root.io.43.4.2-root.io.13.5.13-root.io.13.4.2-root.io.23.4.4-root.io.53.4.4-root.io.63.3.4-root.io.13.3.4-root.io.23.5.12-root.io.22.7.11-root.io.13.4.5-root.io.13.3.4-root.io.33.4.2-root.io.33.4.4-root.io.73.5.13-root.io.24.0.5-root.io.24.0.5-root.io.33.5.12-root.io.14.0.6-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-40973 is a high vulnerability (CVSS 7.0) in Spring Boot, published April 27, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.14%, the 3rd percentile. Fixed in org.springframework.boot:spring-boot 4.0.6.
References
Left out here: 272 versions. The JSON record has them.